Re: [PATCH net-next v1 02/11] net: Add memory provider capabilities

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] xsk: dangling driver pool pointer in xp_assign_dev() [1]
--

commit c73a20cf1440e29e283d9ab9dca3cd14c95d4e33
Author: Björn Töpel <bjorn@kernel.org>

net: Add memory provider capabilities

This commit adds MP_CAP_READABLE and MP_CAP_FRAG capability flags to
describe memory providers and introduces PP_FLAG_MEM_PROVIDER so page
pools can explicitly opt into using readable memory providers.

> diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
> index 7750d2ec4ee24..18966bbdb5b73 100644
> --- a/net/xdp/xsk_buff_pool.c
> +++ b/net/xdp/xsk_buff_pool.c
[ ... ]
> @@ -241,7 +242,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
>  		goto err_unreg_pool;
>  	}
>  
> -	if (dev_get_min_mp_channel_count(netdev)) {
> +	if (!netif_all_mps_have_cap(netdev, MP_CAP_READABLE)) {
>  		err = -EBUSY;
>  		goto err_unreg_pool;
>  	}

[Severity: Critical]
This problem wasn't introduced by this patch, but can the err_unreg_xsk
cleanup path in xp_assign_dev() leave a dangling pool pointer in the
driver [1]?

Just below this hunk, if ndo_bpf() succeeds for XDP_SETUP_XSK_POOL but
leaves pool->dma_pages NULL, xp_assign_dev() jumps to err_unreg_xsk to
call xp_disable_drv_zc(pool) before pool->umem->zc is set:

net/xdp/xsk_buff_pool.c:xp_assign_dev() {
	...
	err = netdev->netdev_ops->ndo_bpf(netdev, &bpf);
	if (err)
		goto err_unreg_pool;

	if (!pool->dma_pages) {
		WARN(1, "Driver did not DMA map zero-copy buffers");
		err = -EINVAL;
		goto err_unreg_xsk;
	}
	pool->umem->zc = true;
	...
err_unreg_xsk:
	xp_disable_drv_zc(pool);
}

Because xp_disable_drv_zc() only calls ndo_bpf() with a NULL pool when
pool->umem->zc is true, it returns without unregistering the pool from the
driver, which can lead to a use-after-free when the pool is freed.

[1] https://sashiko.dev/#/bug/linux-ebfe949d-701b-490d-90a5-2d87285eb1c1

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110102039.1002605-1-bjorn@kernel.org?part=2